Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f0ea5d91 authored by Nicholas Troast's avatar Nicholas Troast
Browse files

qcom-charger: msm_bcl: fix out of bounds array access 



param_type is used for array access before the boundary check. Check the
boundary before using param_type.

Signed-off-by: default avatarNicholas Troast <ntroast@codeaurora.org>
Change-Id: I3d1fb4ada3182c533e5b937717962dc513837e78
parent 4b373689

drivers/power/qcom-charger/msm_bcl.c

+5 −5
Original line number Diff line number Diff line 
/* Copyright (c) 2014, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014, 2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -99,14 +99,14 @@ int msm_bcl_set_threshold(enum bcl_param param_type, 
{

	int ret = 0;



	if (!bcl[param_type] || !bcl[param_type]->registered) {

	if (param_type >= BCL_PARAM_MAX || !bcl[param_type]

		|| !bcl[param_type]->registered) {

		pr_err("BCL not initialized\n");

		return -EINVAL;

	}

	if ((!inp_thresh)

		|| (inp_thresh->trip_value < 0)

		|| (!inp_thresh->trip_notify)

		|| (param_type >= BCL_PARAM_MAX)

		|| (trip_type >= BCL_TRIP_MAX)) {

		pr_err("Invalid Input\n");

		return -EINVAL;
@@ -152,8 +152,8 @@ struct bcl_param_data *msm_bcl_register_param(enum bcl_param param_type, 
{

	int ret = 0;



	if (!bcl[param_type]

		|| param_type >= BCL_PARAM_MAX || !param_ops || !name

	if (param_type >= BCL_PARAM_MAX

		|| !bcl[param_type] || !param_ops || !name

		|| !param_ops->read || !param_ops->set_high_trip

		|| !param_ops->get_high_trip || !param_ops->set_low_trip

		|| !param_ops->get_low_trip || !param_ops->enable